Re: [PATCH] uprobe: avoid out-of-bounds memory access of fetching args

[Oleg Nesterov]

Sorry, currently I don't have time to even try to read this patch, just
one note below...

On 10/14, Ma Qiao wrote:
>
> @@ -979,6 +980,11 @@ static struct uprobe_cpu_buffer 
> *prepare_uprobe_buffer(struct trace_uprobe *tu,
>       ucb = uprobe_buffer_get();
>       ucb->dsize = tu->tp.size + dsize;
>  
> +     if (WARN_ON_ONCE(ucb->dsize > MAX_UCB_BUFFER_SIZE)) {
> +             ucb->dsize = MAX_UCB_BUFFER_SIZE;
> +             dsize = MAX_UCB_BUFFER_SIZE - tu->tp.size;
> +     }
> +

Then you can probably kill the

        if (WARN_ON_ONCE(ucb->dsize > PAGE_SIZE))

check in __uprobe_trace_func(), no?

Oleg.